Multi-Clustering Anomaly Detection for 5G Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current communication networks, particularly 5G and future 6G networks, face challenges in detecting and mitigating AI-driven adversarial attacks due to the adaptive nature of AI systems, which can bypass traditional defense mechanisms and result in high false positive and negative rates when categorizing unknown anomalous data.
Innovation Solution
The implementation of a multi-clustering algorithm approach that combines initial clustering algorithms with a density-based clustering algorithm, such as DBSCAN, to generate co-association and distance matrices, enabling real-time identification of anomalous clusters without pre-defining the number of clusters, and utilizing a voting mechanism to determine malicious traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional defense mechanisms are used to detect and mitigate AI-driven adversarial attacks, then the system structure remains simple and easy to implement, but the detection accuracy deteriorates resulting in high false positive and negative rates
Solution Approach 1:
The patent segments the detection process into multiple independent clustering algorithms (N initial clustering algorithms) that each process the data independently. This segmentation allows the system to achieve high detection accuracy through ensemble voting while maintaining manageable complexity by dividing the overall detection task into smaller, parallelizable components.
Solution Approach 2:
The patent merges the results from N different clustering algorithms through a voting mechanism to produce the final detection decision. This combining approach leverages the strengths of multiple algorithms, achieving high detection accuracy by aggregating their individual outputs while the modular voting structure keeps the overall system complexity controlled.
2Measurement precision
If multiple clustering algorithms are applied to generate co-association and distance matrices, then the detection accuracy improves by reducing false positives and negatives, but the computational complexity increases
Solution Approach 1:
The computational workload is segmented across N independent clustering algorithms that can be executed in parallel. Each algorithm processes the input data independently to generate its own clustering matrix, dividing the overall computational complexity into manageable chunks while maintaining high detection accuracy through the aggregation of multiple independent analyses.
Solution Approach 2:
The co-association matrix serves as an intermediary structure that consolidates the results from N different clustering algorithms. This intermediate representation efficiently captures the consensus information across multiple algorithms, enabling accurate detection while reducing the computational burden of directly comparing all algorithm outputs pairwise.
3Reliability
If real-time categorization of unknown anomalous traffic is performed using the multi-clustering approach, then the security detection capability improves, but the processing time increases
Solution Approach 1:
The real-time detection process is segmented into parallel clustering operations that can execute simultaneously. By dividing the traffic analysis into N independent clustering tasks processed in parallel rather than sequentially, the system achieves high security detection capability while minimizing processing time through concurrent execution.
Solution Approach 2:
The system performs preliminary clustering operations on incoming traffic data before final categorization decisions are made. The N initial clustering algorithms pre-process the data to generate clustering matrices and co-association structures, enabling rapid real-time detection by having the computational groundwork already in place before the actual security assessment is required.
Data Source
AI summary
According to an example aspect of the present invention, there is provided an apparatus, comprising means for performing, receiving input data comprising data points, applying N initial clustering algorithms at least to a subset of said data points to generate N initial clustering matrices, generating a co-association matrix from the N initial clustering matrices, generating a distance matrix from the co-association matrix, applying a density based clustering algorithm to the distance matrix to generate data clusters, determining a subset of the generated data clusters as anomalous clusters, wherein at least some of the data points in each anomalous cluster are anomalous data points and performing at least one action based on the anomalous clusters.